fix: add refresh for OIDC token (#165)

* increase oidc token expiration

* lint

* biuld

* expires_in

* refresh

* private fn

* clean up

---------

Co-authored-by: meorphis <eric@stainless.com>

Author: meorphis

dist/build.js

@@ -19,6 +19,7 @@ import {
 import { getInput, getBooleanInput } from "./input";
 import { setOutput } from "./output";
 import { logger } from "../logger";
+import Stainless from "@stainless-api/sdk";
 
 export {
   isGitLabCI,
@@ -115,11 +116,14 @@ export function getRunUrl() {
     : `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
 }
 
-export async function getStainlessAuthToken(): Promise<string> {
+async function getStainlessAuthToken(): Promise<{
+  key: string;
+  expiresInSeconds: number | null;
+}> {
   const apiKey = getInput("stainless_api_key", { required: isGitLabCI() });
   if (apiKey) {
     logger.debug("Authenticating with provided Stainless API key");
-    return apiKey;
+    return { key: apiKey, expiresInSeconds: null };
   }
 
   logger.debug("Authenticating with GitHub OIDC");
@@ -144,7 +148,8 @@ export async function getStainlessAuthToken(): Promise<string> {
     if (!data.value) {
       throw new Error("No token in OIDC response");
     }
-    return data.value;
+    // GitHub OIDC tokens expire after 5 minutes (this is not configurable as far as we can tell)
+    return { key: data.value, expiresInSeconds: 300 };
   } catch (error) {
     throw new Error(
       `Failed to authenticate with GitHub OIDC. Make sure your workflow has 'id-token: write' permission ` +
@@ -247,3 +252,18 @@ class GitLabCommentClient implements CommentClient {
     });
   }
 }
+
+export const setApiKey = async (stainless: Stainless) => {
+  const { key: apiKey, expiresInSeconds } = await getStainlessAuthToken();
+  stainless.apiKey = apiKey;
+
+  if (expiresInSeconds !== null) {
+    setTimeout(
+      () => {
+        logger.info("Stainless auth token expired, setting new key");
+        setApiKey(stainless);
+      },
+      (expiresInSeconds - 30) * 1000,
+    ); // Refresh 30 seconds before expiry
+  }
+};

dist/index.js

@@ -2,7 +2,7 @@ import Stainless from "@stainless-api/sdk";
 import { getStainlessClient } from "./stainless";
 import { readFileSync, writeFileSync } from "node:fs";
 import YAML from "yaml";
-import { getBooleanInput, getInput, getStainlessAuthToken } from "./compat";
+import { getBooleanInput, getInput, setApiKey } from "./compat";
 import { logger } from "./logger";
 
 // https://www.conventionalcommits.org/en/v1.0.0/
@@ -16,7 +16,6 @@ export const isValidConventionalCommitMessage = (message: string) => {
 
 export async function main() {
   // inputs
-  const stainless_api_key = await getStainlessAuthToken();
   const inputPath = getInput("input_path", { required: true });
   const configPath = getInput("config_path", { required: false });
   let projectName = getInput("project_name", { required: false });
@@ -40,9 +39,8 @@ export async function main() {
   }
 
   if (!projectName) {
-    const stainless = getStainlessClient("index", {
-      apiKey: stainless_api_key,
-    });
+    const stainless = getStainlessClient("index", {});
+    await setApiKey(stainless);
     const projects = await stainless.projects.list({ limit: 2 });
     if (projects.data.length === 0) {
       const errorMsg = "No projects found. Please create a project first.";
@@ -65,7 +63,6 @@ export async function main() {
   const response = await uploadSpecAndConfig(
     inputPath,
     configPath,
-    stainless_api_key,
     projectName,
     commitMessage,
     guessConfig,
@@ -102,7 +99,6 @@ export async function main() {
 async function uploadSpecAndConfig(
   specPath: string,
   configPath: string | undefined,
-  token: string,
   projectName: string,
   commitMessage: string | undefined,
   guessConfig: boolean,
@@ -116,9 +112,9 @@ async function uploadSpecAndConfig(
   decoratedSpec: string | null;
 }> {
   const stainless = getStainlessClient("index", {
-    apiKey: token,
     project: projectName,
   });
+  await setApiKey(stainless);
   const specContent = readFileSync(specPath, "utf8");
 
   let configContent;

dist/merge.js

@@ -1,6 +1,6 @@
 import Stainless from "@stainless-api/sdk";
 import { getInput } from "./compat/input";
-import { getStainlessAuthToken } from "./compat";
+import { setApiKey } from "./compat";
 import { getStainlessClient } from "./stainless";
 import { logger } from "./logger";
 
@@ -27,12 +27,13 @@ export function wrapAction(
 
     try {
       projectName = getInput("project", { required: true });
-      const apiKey = await getStainlessAuthToken();
       stainless = getStainlessClient(actionType, {
         project: projectName,
-        apiKey,
         logLevel: "warn",
       });
+
+      await setApiKey(stainless);
+
       await fn(stainless);
       await maybeReportResult({
         stainless,